Data processing on behalf means that an external service provider processes personal data on behalf of a company—for example, a web analytics or tracking tool such as Google Analytics or Trackboxx acting for the website operator.
As soon as a tool collects data such as IP addresses or user behaviour, a data processing agreement (DPA) is required under the GDPR. It defines the purpose and scope of the processing as well as the technical safeguards.
Important: The website operator remains responsible for data protection, even when the processing is outsourced.